https://community.splunk.com/t5/Deployment-Architecture/How-to-assign-a-password-to-the-Universal-Forwarder-to-prevent/m-p/488525#M16925 <P>Hello everyone,</P> <P>Is there a way to assign a password to the universal forwarder to prevent it from being uninstalled?</P> <P>or what options do i have?</P> <P>Thanks</P> <P>Regards</P> Wed, 10 Jun 2020 19:53:16 GMT edgarsilva01 2020-06-10T19:53:16Z https://community.splunk.com/t5/Deployment-Architecture/How-to-assign-a-password-to-the-Universal-Forwarder-to-prevent/m-p/488525#M16925 <P>Hello everyone,</P> <P>Is there a way to assign a password to the universal forwarder to prevent it from being uninstalled?</P> <P>or what options do i have?</P> <P>Thanks</P> <P>Regards</P> Wed, 10 Jun 2020 19:53:16 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-assign-a-password-to-the-Universal-Forwarder-to-prevent/m-p/488525#M16925 edgarsilva01 2020-06-10T19:53:16Z https://community.splunk.com/t5/Deployment-Architecture/How-to-assign-a-password-to-the-Universal-Forwarder-to-prevent/m-p/488526#M16926 <P>Hello @edgarsilva01</P> <P>I believe the question is more on user's operating system rights/permission to modify the UF.</P> <P>As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not.</P> <P><STRONG>Linux:</STRONG><BR /> Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser">https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser</A></P> <P><STRONG>Windows:</STRONG><BR /> Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD.</P> <P>Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode.</P> <P><A href="https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller">https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller</A></P> <P>Hope it helps!</P> Wed, 29 Apr 2020 01:07:22 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-assign-a-password-to-the-Universal-Forwarder-to-prevent/m-p/488526#M16926 lloydknight 2020-04-29T01:07:22Z